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Abstract 

This  paper  provides  an  overview  of  the  results  of  a  con¬ 
tinuous,  2-month  experimental  evaluation  of  all  tim¬ 
ing  data  provided  by  several  GPS  receivers.  The  pri¬ 
mary  purpose  of  this  experiment  was  to  provide  mea¬ 
surement  data  facilitating  fault  modeling  in  our  project 
SynUTC1,  which  aims  at  external  clock  synchronization 
in  fault- tolerant  distributed  real-time  systems.  As  ex¬ 
pected,  the  GPS  receivers  under  test  exhibited  a  wide 
variety  of  failures,  ranging  from  transient  omissions  up 
to  considerable  deviations  of  the  timing  signals  pro¬ 
vided.  Whereas  those  findings  justify  the  appropriate¬ 
ness  of  our  basic  failure  assumptions,  it  became  never¬ 
theless  apparent  that  rerunning  the  experiment  for  a 
longer  duration  and  with  new  brands/models  of  GPS 
receivers  is  advisable. 

Keywords:  experimental  evaluation,  GPS  timing  re¬ 
ceivers,  integrity,  availability,  reliability,  faults,  external 
clock  synchronization,  fault- tolerant  distributed  real¬ 
time  systems. 

1  Introduction 

A  rapidly  increasing  number  of  users  rely  upon  GPS 
as  the  primary/sole  means  for  acquiring  highly  accu¬ 
rate  positioning  and  timing  information,  see  [Dan97] 
for  an  overview.  In  fact,  the  introduction  of  the  GPS 
caused  a  revolution  in  such  different  areas  as  navigation, 
land  surveying,  and  time  transfer,  and  provides  enabling 
technology  for  many  diverse  appli cations  in  those  ar¬ 
eas.  Despite  of  the  unrivaled  accuracy  and  reliability 
of  GPS,  however,  applications  eventually  emerged  that 
caused  serarching  questions  of  what  quality  of  service 
can  actually  be  expected  from  the  GPS. 

Primarily  driven  by  the  stringent  safety  require¬ 
ments  of  civil  aviations  [Dur90],  integrity  of  the  tim- 
ing/po$itioning  data  provided  by  GPS  receivers  be¬ 
came  a  primary  issue  in  GPS  research.  Several  receiver 
autonomous  monitoring  (RAIM,  see  e.g.  [BSK89], 

1  This  research  is  part  of  our  project  SynUTC,  which  has  been 
supported  by  the  Austrian  Science  Foundation  (FWF)  under 
grant  no.  P10244-OMA  and  is  now  continued  under  the  START 
programme  Y4 1-MAT. 


[Mic95])  and  failure  detection  and  isolation  (FDI,  see 
e.g.  [DL95],  [BD94])  schemes  were  developed,  which  try 
to  identify  /remove  apparently  erroneous  data.  In  the 
meantime,  such  techniques  are  pretty  standard  and  in¬ 
corporated  in  low-cost  GPS  receivers  [GKKT95]  as  well. 

Although  RAIM/FDI  techniques  considerably  in¬ 
crease  the  reliability  of  the  positioning/ timing  output 
of  a  GPS  receiver,  there  are  nevertheless  inherent  limi¬ 
tations.  As  a  remedy,  augmentations  of  the  GPS  have 
been  proposed,  which  distribute  information  from  exter¬ 
nal  monitoring  of  the  GPS  satellites  via  dedicated  GPS 
Integrity  Channels  (GIC);  see  e.g.  [BC94],  [VMLE94]. 
Related  standardization  efforts  like  the  Wide  Area  In¬ 
tegrity  Broadcast  (WIB)  [DE94];  however,  primarily 
target  FAA’s  GPS  Wide-Area  Augmentation  System 
(WAAS)  and  are,  hence,  not  likely  to  be  incorporated 
in  commercial  (low-cost)  GPS  receivers. 

Whether  RAIM/FDI/GIC  is  employed  or  not,  how¬ 
ever,  there  is  the  problem  of  assessing,  i.e.,  determin¬ 
ing,  GPS  integrity.  In  fact,  any  appropriate  experi¬ 
mental  evaluation  is  difficult  since  GPS  failures  are  rare 
events  —although  manufacturers  of  GPS  receivers  are 
well  aware  of  their  occurence,  see  [Dan97],  [GKKT95]— 
that  are  not  easy  to  observe  and  to  trace  back  [Gol90] 
in  practice.  Comprehensive  fault  modelling  is  also  dif¬ 
ficult  due  to  the  fact  that  GPS  is  a  complex  system, 
with  many  potential  sources  of  errors:  Faults  leading 
to  an  erroneous  positioning/timing  output  of  a  GPS  re¬ 
ceiver  may  occur  in  the  quite  advanced  receiver  electron¬ 
ics  [Die95]»as  well  as  in  the  GPS  space  and/or  control 
segment.  Note  that  it  is  even  non- trivial  to  characterize 
the  “normal”  (fault*free)  operation  of  GPS;  see  [Con93], 

Most  existing  attempts  to  assess  GPS  integrity  hence 
consider  faults  in  the  space  segment  (“satellite  out¬ 
ages”)  only.  Relying  on  an  a  posteriori  anaysis  of  ob¬ 
servational  data,  fault  models  like  the  ones  of  [DC90], 
[DC91],  [PPP94]  assume  satellite  failure  probabilities 
of  about  1CT4  per  hour.  Simulation  is  the  primary 
evaluation  tool  in  the  vast  majority  of  related  work 
[DL95],  [BSKS9],  [GKKT95],  [PPP94],  [VMLE94];  we 
only  know  of  a  few  papers  [BD94],  [Dyk92],  [DBS93], 
[NT93]  that  deal  with  experimental  evaluation  as  well. 

Given  those  limitations,  it  is  not  too  surprising 
that  usual  assessments  of  integrity  are  not  particularily 
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meaningful  for  even  more  demanding  GPS  applications. 
For  example,  when  GPS  receivers  are  used  as  the  sole 
means  for  establishing  a  common  notion  of  time  in  fault- 
tolerant  distributed  real-time  systems,  not  even  a  single 
erroneous  timing  datum  should  occur  or  escape  detec¬ 
tion.  By  contrast,  typical  integrity-dependent  applica¬ 
tions  like  civil  aviations  usually  only  require  one  “cer¬ 
tified”  positioning/timing  datum  within  a  certain  time 
interval.  Reasoning  about  (or,  as  in  our  case,  arguing 
against2)  such  “naive”  GPS  applications,  however,  re¬ 
quires  knowledge  of  the  erroneous  behavior  of  any  tim¬ 
ing  datum  provided  by  a  GPS  receiver  —  something 
that  cannot  be  inferred  from  existing  integrity  reports. 

Therefore,  when  we  started  our  work  on  external 
clock  synchronization  in  fault-tolerant  distributed  real¬ 
time  systems  [Sch94],  we  decided  to  conduct  some  ex¬ 
periments  of  our  own  to  justify  our  undertaking  and  to 
facilitate  the  task  of  fault  modeling.  Acontinuousexper- 
imentai  evaluation  of  six  commercially  available  GPS 
timing  receivers  was  eventually  performed  from  Decem¬ 
ber  12,  1995  to  February  15,  1996,  which  is  comprehen¬ 
sively  documented  in  [Hoe96], 

This  paper  provides  an  overview  of  the  most  impor¬ 
tant  results  obtained  from  the  analysis  of  the  778  MB 
of  sampled  data.  It  is  organized  as  follows:  In  Sec¬ 
tion  2,  we  provide  some  information  on  fault-tolerant 
distributed  real-time  systems  that  will  further  motivate 
our  study.  Section  3  contains  an  overview  of  our  mea¬ 
surement  setup,  Section  4  elaborates  on  the  generation 
of  the  reference  time  scale.  The  actual  results  of  our  ex¬ 
perimental  evaluation  are  presented  in  Section  5,  along 
with  a  number  of  graphs  and  charts  contained  in  the 
appendix.  Some  conclusions  and  directions  of  further 
work  provided  in  Section  6  eventually  complete  our  pa¬ 
per. 

2  Fault-Tolerant  Real-Time  Applications 

It  is  well-known  that  designing  distributed  real-time  sys¬ 
tems  is  considerably  simplified  when  local  clocks  dis¬ 
playing  a  common  (global)  notion  of  time  are  available 
at  all  computing  nodes.  Temporally  ordered  events  are 
in  fact  beneficial  for  a  wide  variety  of  tasks,  ranging 
from  relating  sensor  data  gathered  at  different  nodes 
up  to  fully-fledged  distributed  algorithms,  see  [Lis93] 
for  some  examples.  A  synchronization  tightness  in  the 
ms-range  is  usually  sufficient  here,  although  there  are 
applications  like  [Mar96]  that  call  for  a  /is-range  pre¬ 
cision.  To  achieve  this  goal,  it  is  common  practice  in 
industry  to  equip  each  node  of  the  distributed  system 
with  a  modular  GPS  timing  receiver. 

This  solution,  however,  is  not  feasible  when  strin¬ 
gent  fault-tolerance  requirements  are  to  be  met.  For 
example,  it  was  noted  in  [GKKT95]  that  a  prototype 

2 We  are  of  course  aware  of  the  fact  that  any  experimental 
evaluation  can  only  provide  a  “snapshot”  of  possible  failures, 
which  is  not  sufficient  for  confirming  a  certain  failure  assump¬ 
tion.  However,  the  outcome  of  an  experiment  can  invalidate  one, 
thereby  increasing  the  verisimifitude  (truthlikeness,  see  [Pop89, 
Chap.  10])  of  the  “surviving”  assumptions,  and  this  is  why  ex¬ 
periments  are  nevertheless  appropriate. 


TDMA  communications  system  at  Motorola  eventually 
broke  down  due  to  a  certain  GPS  failure.  Similarily, 
real-time  systems  architectures  like  the  one  of  [HW97] 
that  simply  phase-lock  an  internal  clock  to  the  1  pps  (1 
pulse-per-second)  output  of  a  GPS  timing  receiver  are 
bound  to  assign  incorrect  timestamps  — taken  arbitrar¬ 
ily  in  a  one-second  interval —  if  there  is  just  a  single 
incorrect  1  pps  pulse.  Obviously,  to  assess  the  overall 
reliability  of  such  systems,  the  erroneous  behavior  of  all 
timing  data  provided  by  a  GPS  receiver  must  be  known. 

To  satisfy  increased  reliability  requirements,  fault- 
tolerant  external  clock  synchronization  techniques  have 
been  developed;  see  [Sch97]  for  the  current  status  of  re¬ 
search.  Among  these  is  our  interval-based  clock  valida¬ 
tion  approach  introduced  in  [Sch94]  and  further  devel¬ 
oped  in  a  number  of  papers  [SS97],  [Scho97],  [SSHL97], 
[HSS97],  etc.,  which  solves  the  external  clock  syn¬ 
chronization  problem  for  large-scale,  fault- tolerant  dis¬ 
tributed  real-time  systems.  It  is  based  on  the  idea 
of  verifying  whether  the  highly  accurate,  but  possibly 
faulty,  “authoritative  time”  supplied,  e.g.  by  a  GPS  re¬ 
ceiver,  is  consistent  with  some  less  accurate  but  reli¬ 
able  “validation  time”  backed  up  by  all  the  nodes’  local 
(quartz)  clocks.  If  so,  the  distinguished  time  is  accepted; 
otherwise,  it  is  discarded  and  the  nodes  rely  on  the  val¬ 
idation  time  instead.  In  essence,  our  clock  validation 
technique  simultaneously  increases  the  fault- tolerance 
degree  and  decreases  the  total  number  of  GPS  receivers 
required  in  the  distributed  system.  Consequently,  it 
does  not  suffer  from  the  “forest”  of  GPS  antennas  that 
would  be  required  for  a  large  (LAN-based)  distributed 
system  with  dedicated  GPS  receivers.  Still,  information 
on  all  possible  failures  of  GPS  receivers  is  mandatory 
here  as  well  for  proper  fault  modeling. 

From  the  above  considerations,  it  is  apparent  that 
one  should  know  as  much  as  possible  about  those  (rare) 
events  where  a  GPS  timing  receiver  provides  erroneous 
data.  Getting  this  information,  however,  is  difficult 
enough  under  “ideal”  operating  conditions,  and  in  fact 
made  worse  by  the  requirement  of  covering  issues  like 
receiver  (software)  errors  as  well  as  suboptimal  recep¬ 
tion  and  interfacing  conditions.  After  all,  circumstances 
like  a  250  fjs  timing  bias  (as  exhibited  by  our  first 
NavSymm  receiver)  cannot  be  detected  without  exter¬ 
nal  verification,  which  will  usually  never  take  place 
in  real  applications:  Commonly,  an  off-the-shelf  GPS 
receiver  is  connected  to  an  interface,  undergoes  some 
configuring  (without  knowing  the  antenna’s  exact  3D- 
position)  —  and  is  then  assumed  to  provide  correct 
time. 

Hence,  we  argue  that  a  meaningful  experimental 
evaluation  need  not  care  about  “fairness”  and  llnomi- 
nal  test  conditions”  and  similar  things  that  are  likely 
to  be  violated  in  practice.  Consequently,  we  did  not 
run  our  experiment  with  multiple  instances  of  the  same 
receiver,  and  did  not  not  bother  too  much  with  optimiz¬ 
ing  antenna  positions  (w.r.t.je.g., multipath  problems)  or 
detecting  presumed  signaling  noise  across  the  interface. 
We  are  convinced,  though,  that  our  results  are  more 
meaningful  for  practical  purposes  than  those  obtained 
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under  “artificial”  test  conditions*  Bear  in  mind,  how¬ 
ever,  that  our  evaluation  does  not  impose  a  legitimate 
ranking  of  the  evaluated  receivers’  potential  capabilities. 

3  Experimental  Setup 

Having  decided  on  the  general  issues,  our  first  task  (Dec. 
1994  -  Jan*  1995)  was  selection  and  purchase  of  “rep¬ 
resentative”  GPS  receivers.  Constrained  by  our  lim¬ 
ited  budget,  we  were  looking  for  an  affordable  collection 
of  timing  receivers  that  reasonably  covers  the  available 
spectrum.  Based  on  a  market  survey  guided  by  [GPS94] 
and  [GPS95],  we  eventually  chose  the  models  listed  in 
Table  1* 

The  market  survey  was  also  used  to  decide  the 
question  of  what  kind  of  GPS  interface  our  custom 
clock  synchronization  hardware,  namely,  the  Network 
Time  Interface  (NTI)  M-Module  [HSS97]  resp*  its  piv¬ 
otal  UTCSU-ASIC  [SSHL97],  should  provide*  Since  it 
turned  out  that  all  timing  receivers  support 

•  a  digital  (usually  TTL-level)  1  pps  signal  that  ac¬ 
curately  indicates  the  beginning  of  a  second, 

•  a  serial  interface  utilizing  some  (proprietary)  pro¬ 
tocol  to  supply  the  current  time  tag  (minute,  hour, 
day,  year)  as  well  as  additional  status  information, 

whereas  a  few  high-end  receivers  also  provide 

•  an  additional  digital  status  signal  to  indicate 
health  of  the  1  pps  pulse, 

•  a  10  MHz  frequency  output , 

we  decided  to  support  both  the  1  pps  and  a  status  sig¬ 
nal.  Moreover,  our  NTI  can  optionally  be  paced  with 
an  externally  supplied  10  MHz  frequency. 

The  next  step  was  to  conceive  questions  that  were  to 
be  answered  by  our  experimental  evaluation*  With  r(£) 
denoting  the  deviation  of  a  receiver’s  view  of  time  and  a 
suitable  reference  time  (ideally,  t)  at  the  occurrence  time 
t  of  the  appropriate  1  pps  pulse,  the  most  important 
ones  can  be  stated  as  follows: 

(1)  How  does  the  distribution  function  of  the  devia¬ 
tions  :r(t)  look  like? 

(2)  How  does  the  distribution  function  of  Ai(t)  = 
x(t  -hr)  —  x(t)  for  some  fixed  r,  i.e.,  the  differ¬ 
ence  between  deviations  lying  r  seconds  apart,  look 
like? 

(3)  Same  as  above  for  an  “artificial”  1  pps  pulse  ob¬ 
tained  by  dividing  the  10  MHz  frequency  output 
(if  provided)  by  107 . 

(4)  Are  there  missing  or  faulty  1  pps  pulses  and  how 
does  x(t)  behave  in  such  cases? 

(5)  Is  there  wrong  information  (time  tag,  health  sta¬ 
tus)  provided  via  the  serial  interface? 

We  will  justify  the  appropriateness  of  the  above  ques¬ 
tions  in  Section  5,  where  we  discuss  our  results* 

For  data  aquisition,  answering  those  questions  im¬ 
plies  collection  of  the  one-second  timing  information  of 


all  GPS  receivers  for  the  full  period  of  measurement. 
This  means  that  each  1  pps  pulse  (including  the  arti¬ 
ficial  ones  derived  from  the  10  MHz  outputs)  of  each 
GPS  receiver  must  be  “timestamped”  according  to  a 
reference  clock  and  stored  for  later  processing.  In  addi¬ 
tion,  the  information  provided  via  the  receivers’  serial 
interfaces  must  be  correctly  associated  and  saved  with 
those  timestamps. 

In  reality,  this  problem  becomes  difficult  due  to  the 
fact  that  one  has  to  do  this  simultaneously  for  several 
1  pps  signals  and  with  a  few  ns  resolution.  Of  course, 
there  are  manufacturers  offering  highly  sophisticated 
equipment  for  measuring  phase  differences  of  a  single 
input  against  a  reference  signal.  Our  limited  budget, 
however,  did  not  allow  us  to  replicate  such  expensive 
equipment* 

The  eventually  chosen  experimental  setup  shown  in 
Figure  1  thus  incorporates  the  following  standard  com¬ 
ponents  only: 

•  On  top  of  the  figure,  there  are  the  GPS  Receivers 
under  test  (see  Table  1),  along  with  the  107  :  1 
prescalers  for  the  10  MHz  outputs  provided  by  the 
Stellar  and  the  NavSymm  receiver. 

•  The  10  MHz  output  of  the  Reference  Clock  (Ball 
Efratom  FRS-C  rubidium  clock  in  a  climatic  hous¬ 
ing)  is  divided  by  105  resp.  107  to  generate  a 
100  pps  resp,  1  pps  reference  signal.  In  addition, 
another  prescaler  S  :  1  is  responsible  for  providing 
a  symmetric  trigger  signal  with  period  8  s  used  for 
alternation  control  (see  below). 

•  At  the  heart  of  our  setup  are  two  Logic  Analyzers 
LAI  and  LA2  (HP  16500B)  used  for  sampling  the 
1  pps  pulses  with  8  ns  resolution*  Note  that  we 
utilized  the  analyzers’  event  trigger  mode,  where  a 
timestamp  of  the  internal  LA  clock  is  sampled  into 
memory  upon  occurrence  of  a  pulse  at  any  input 
channel. 

Both  logic  analyzers  alternately  perform  data  aqui¬ 
sition  and  memory  transfer  to  the  Measurment  PC 
via  a  HP  IB  interface*  More  specifically,  the  leading 
edge  of  the  8  s  trigger  signal  mentioned  above  ini¬ 
tiates  sampling  at  LAI  and  causes  LA2  to  be  read 
out,  whereas  the  falling  edge  triggers  sampling  at 
LA2  and  read  out  of  LAI,  This  way,  continuous 
measurement  is  accomplished. 

•  Apart  from  being  responsible  for  reading  out  the 
memory  of  the  logic  analyzers  via  the  HPIB  inter¬ 
face,  the  Measurement  PC  also  provides  the  serial 
interfaces  required  for  getting  time  tag  and  sta¬ 
tus  information  from  the  GPS  receivers.  It  asso¬ 
ciates  the  1  pps  data  from  the  LA  with  the  ad¬ 
ditional  information  and  computes  a  full  reference 
timestamp  by  combining  the  LA  clock  timestamps 
with  the  sampled  100  pps  rubidium  pulses.  Com¬ 
plete  records,  including  “spurious  pulse”  data,  are 
eventually  sent  to  the  Server  PC  via  a  RS-232  in¬ 
terface. 
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•  Finally,  the  Server  PC  is  responsible  for  storing 
the  data  sent  by  the  Measurement  PC  on  disk,  one 
separate  file  for  each  hour  of  measurement.  It  is 
connected  to  the  campus  network  for  easy  access 
and  backup  purposes. 

4  Reference  Time 

In  the  course  of  our  experimental  evaluation,  all  1  pps 
pulses  from  the  GPS  receivers  were  timestamped  ac¬ 
cording  to  a  free^unning  reference  clock .  As  outlined  in 
the  previous  section,  this  is  basically  a  rubidium  atomic 
clock  augmented  by  the  logic  analyzers’  high-resolution 
internal  clocks.  In  view  the  long  measurement  period 
vs.  the  relatively  low  stability  of  the  rubidium  clock, 
however,  we  cannot  simply  use  those  reference  clock 
readings  as  a  reference  time.  We  need  to  establish  an 
“artificial”  reference  time  instead,  which  approximates 
real-time3  as  accurately  as  possible.  For  this  purpose, 
we  take  advantage  of  the  fact  that  a  great  deal  of  the 
stochastic  fluctuations  of  the  1  pps  pulses  of  a  high- 
quality  GPS  receiver  vary  not  too  slowly,  so  that  they 
can  be  averaged  out  even  by  our  low  performance  refer¬ 
ence  clock. 

More  formally,  with  T (clock,  t)  denoting  the  time 
value  some  specified  clock  displays  at  real  time  t ,  the 
offset  x(t)  of  the  best  of  our  GPS  receivers  (Stellar) 
from  the  reference  clock,  observed  at  any  time  t  when  a 
1  pps  pulse  from  the  Stellar  occurs,  can  be  written  as 

x(t)  =  T(Stellar,  t)  —  T(Refclock,  t).  (1) 

The  offset  x(t)  is  impaired  by  both  systematic  (de¬ 
terministic)  deviations  and  stochastic,  zero-mean  noise 
originating  in  either  the  Stellar’s  1  pps  pulses  or  the  ref¬ 
erence  clock.  Apart  from  constant  time  and  frequency 
offsets  (irrelevant  for  our  purposes),  the  sampled  data 
reveal  a  systematic  frequency  drift  Do  &  5  •  10-18  $~x, 
which  is,  however,  small  enough  to  be  ignored.  To  an¬ 
alyze  the  stochastic  part,  we  employ  the  well-known 
device  of  power  spectral  analysis  (see  [Ste85]  for  an 
overview  and  e.g.  [Car86]  for  a  thorough  introduction): 
By  means  of  Fourier  analysis  techniques,  the  (one-sided) 
power  spectral  density  $x(f)  depicted  in  Figure  2  can  be 
computed  from  the  sampled  data  x(t),  which  gives  the 
“signal  power”  per  unit  frequency  at  the  particular  cen¬ 
ter  frequency  /.  Therefore,  the  area  under  Sx(f)  in  a 
range  /i  <  /  <  h  gives  the  proportion  of  the  total  sig¬ 
nal  power  of  x(t)  caused  by  its  frequency  contributions 
lying  in  [fufz]. 

We  should  add  that  Sx(f)  was  actually  computed 
from  the  power  spectral  density  Sy(f)  of  the  first  differ¬ 
ences  of  #(£),  which  satisfy  a  well-known  relation.  The 
required  Sy  (/)  was  obtained  by  applying  a  Fast  Fourier 
Transform  to  the  entire,  properly  Hanning-windowed 
data  sample.  As  elaborated  in  [WPI89],  this  produces 

3 We  actually  used  GPST  (the  inherent  system  time  of  the 
GPS)  instead  of  UTC  as  our  notion  of  real-time.  Apart  from  an 
integer  number  of  leap  seconds,  GPST  is  almost  equivalent  to 
UTC,  since  it  is  steered  to  follow  the  MasterClockof  the  United 
States  Naval  Observatory  UTC(USNO,  MC)  with  high  accuracy. 


a  basically  unbiased  estimate  of  the  spectrum  at  “rea¬ 
sonable”  frequencies,  since  the  Hanning  window  re¬ 
moves  the  distorting  effect  of  spectral  leakage.  How¬ 
ever,  it  introduces  gross  errors  at  the  lowest  frequencies, 
which  can  be  corrected  by  exploiting  the  well-known 
fact  [A1187J  that  there  should  be  a  dominating  random 
walk  behavior  originating  in  the  rubidium  clock.  Note 
that  the  particular  noise  level  was  determined  by  some 
additional  measurements  of  our  rubidium  clock  against 
a  cesium  normal,  which  were  conducted  for  verification 
purposes. 

Figure  2  reveals  a  number  of  interesting  facts  about 
the  noise  actually  present  in  #(£): 

•  For  frequencies  up  to  10“2  Hz  (period  of  100  s), 
we  are  primarily  concerned  with  white  phase  noise 
caused  by  the  granularity  of  our  reference  clock. 

•  For  lower  frequencies  down  to  approximately 
10-s  Hz  (period  of  100000  s),  white  phase  noise 
originating  from  the  1  pps  output  dominates.  It 
is  primarily  caused  by  the  GPS’  Selective  Avail¬ 
ability  (SA),  a  deliberate  distortion  of  orbital  and 
clock  data  of  the  satellites,  which  has  been  imple¬ 
mented  to  reduce  the  accuracy  available  to  civilian 
GPS  users.  Taking  into  account  that  the  Stellar  av¬ 
erages  over  5  different  satellites,  we  find  the  level 
of  noise  in  accordance  with  observation  of  others 
[Tho93]. 

•  There  are  also  two  interesting  peaks  in  the  spec¬ 
trum:  The  first  one  appears  at  a  frequency  corre¬ 
sponding  to  a  period  of  one  day  and  is  probably 
caused  by  the  daily  variations  of  ionospherical  and 
tropospherical  conditions.  The  second  peak  at  a 
period  of  half  a  day  is  presumably  a  consequence 
of  the  second  harmonic  of  the  first  peak  and  the 
12-hour  periodicity  of  the  GPS  satellite  constella¬ 
tion,  which  can  produce  such  variations  in  case  of 
imperfectly  known  antenna  positions, 

•  At  even  lower  frequencies  (with  a  period  longer 
than  a  day),  the  random  walk  frequency  noise  of 
the  rubidium  clock  dominates.  Note  that  it  hides 
any  slowly  varying  noise  of  the  1  pps  pulses. 

This  information  on  the  noise  of  x(t)  can  be  ex¬ 
ploited  to  establish  a  less  noisy  reference  time,  which 
will  be  developed  subsequently.  Our  approach  rests 
upon  a  good  approximation  of  the  offsets  xgpst  an  ideal 
GPS  receiver  (continuously  displaying  perfect  GPST) 
would  provide  w.r.t.  our  reference  clock,  at  arbitrary 
real-times  t: 

sgfstM  =  T(GPST,£)  -T(Refclock,  t),  (2) 


recall  that  we  chose  GPST  as  our  measure  of  real-time, 
hence  T(GPST,  t)  =  t.  Since  the  actually  sought  offsets 
2*ny  (t)  of  any  GPS  receiver  and  GPST  can  be  obtained 
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via 


z4ny(t)  =  T(any,  t)  —  T(GPST,  t)  =  Zany(£)  -  sgpstW’ 

- -v - - 

(3) 

where  of  course 


x4ny(t)  =  T(any,  t)  -  T(Refclock,  t ),  (4) 

we  only  need  a  good  approximation  of  #GPST(t)  to  com¬ 
pute  a  good  approximation  of  £any(£).  Note  carefully 
that  (3)  is  totally  independent  of  the  reference  clock. 
To  be  able  to  use  our  knowledge  of  the  noise  prop¬ 
erties  of  the  1  pps  pulses  of  the  Stellar,  we  define 


zs(<)  =  T(Stellar,  t)  —  T(GPST,  £)  =  4(i)  +  <s(*),  (5) 


taken  at  any  occurrence  time  t  of  a  1  pps  pulse.  Herein, 
Cs(£)  is  meant  to  cover  only  known  stochastic  deviations 
(white  phase  noise  from  SA),  whereas  z|(t)  contains 
the  unknown  rest,  i.e.,  systematic  deviations  and  slowly 
varying  stochastic  deviations  (hidden  by  the  rubidium 
clock’s  random  walk  noise). 

Similarly,  we  split  the  time  deviations 

zR(t)  =  T(rb  clock,  t)  -  T(GPST,  t)  =  z°R(t)  + 

^  II  !■>!  I  / 

(6) 

of  the  rubidium  clock  in  a  stochastic  part  Cr(£)  and  a 
systematic  part  z^{t),  which  can  be  described  around  a 
certain  moment  in  time  tr  by  a  quadratic  polynomial 


Z%(t)  =  Zo(tr)  +  yo(tr)  *  ( t  -  tr  )  H - ^ J  ^  (t  —  tr)2  -  (7) 

With  the  foregoing  definitions,  the  measured  offset 
x(t)  can  of  course  be  rewritten  as 

x (t)  =  z$(t)  -  zR(t).  (8) 

With  f(t)  denoting  the  result  of  applying  any  linear 
averaging  operation  — to  be  fully  specified  later—  to 
fit),  we  hence  obtain 


ZR(t)  —  zR(t),  Hence,  our  goal  must  be  to  choose  an  av¬ 
eraging  operation  that  provides  a  suitable  tradeoff.  For 
that  purpose,  we  introduce  the  linear  averaging  opera¬ 
tion 

oo 

I  h{T)x(t  —  r)dr,  (12) 

—  oo 

along  with  two  reasonable  constraints  on  the  weighting 
function  h(r ),  namely 

oo 

J  h{r)dr  =  1,  and  h(r)  ~  h(— r).  (13) 

—  oo 


Splitting  zs{t)  resp.  zR(t)  into  their  corresponding 
systematic  and  stochastic  parts  according  to  (5)  resp. 
(6),  we  can  express  (10)  as 

z(t)  =  zgpst(0  +  .4(*)  +  (*fi(*)  -  *&(*))  + 

' - - - ' 

systematic 

fc(i) +  (&(*)-&(*))■  (14) 

S - V - ' 

stochastic 

Since  25  (t)  was  assumed  to  consist  of  the  systematic 
errors  and  slowly  varying  stochastic  components,  we  can 
reasonably  infer  that  z%(t)  ~  z°s(t),  provided  that  the 
weighting  function  h{r)  is  such  that  it  puts  (almost) 
zero  weight  to  large  r.  For  determining  we  apply 

the  averaging  operation  (12)  to  (7)  to  obtain 


—  ^o(^r)  ~¥  yo{tr)  *  (t  ■  tr) 


Deriving  this  result,  we  used  the  fact  that  the  required 

oo 

even  symmetry  of  h(r)  imphes  f  rh(T)dr  =  0. 

—  oo 

Subtracting  (15)  from  (7),  we  arrive  at 


x(t)  =  z$(t)-zR(t).  (9) 

Combining  this  with  ^GPST(t)  =  —  zR(t),  which  is  ap¬ 
parent  from  comparing  (2)  and  (6),  we  find 

a(t)  —  #gpst (t)  +  *s(t)  +  (zR(t)  -  zR(t))  .  (10) 


zr(*) -*%.(*)- -D°  2^  j  h(T)T2dT.  (16) 
—  oo 

Choosing  the  reference  point  tr  “  £,  (14)  can  eventually 
be  written  as 


If  the  second  and  third  term  on  the  right  hand  side 
of  (10)  are  small,  we  have  found  a  good  approximation 
of  GPST.  To  compare  this  with  the  situation  without 
averaging,  we  observe  e.g.  from  (1)  and  (2)  that 

x{t)  =  xgpst  (t)  +  zs(t).  (11) 

Averaging  thus  yields  a  reduction  of  ^s(t)  zs{t ),  but 
introduces  new  contributions  from  the  reference  clock 


x(t)  =  aGPST(t)  +  *!(t)  -  J  h(r)r2dr 

—  oc 

+ow +  (<*(*) -c^))-  (17) 

Note  that  the  systematic  frequency  drift  Do(t)  was  de¬ 
termined  to  be  about  Do  ss  5  ■  10™18  s^1,  independently 
of  t,  which  yields  a  negligible  contribution  in  (17). 
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Having  settled  the  systematic  parts  in  (17),  we  now 
turn  our  attention  to  the  stochastic  ones  abbreviated  by 

C(0  =  Cs(0  +  (Cfl(t)  -  C Our  purpose  is  still  to 
fix  the  weighting  function  h(r)  to  be  used  in  the  aver¬ 
aging  operation.  This  is  done  by  extracting  the  individ¬ 
ual  power  spectral  densities  Ss(f)  of  £$(t)  and  Sr( f) 
of  Qi(t)  from  Figure  2,  and  choosing  a  function  h(r) 
that  minimizes  the  spectral  density  S<;(f)  of  £(£),  i.e,, 
the  (known)  stochastic  noise  present  in  (10)*  Note  that 
once  h(r)  is  determined,  the  sought  approximation  r(t) 
of  #gpst  (t)  can  be  computed  numerically  from  the  sam¬ 
pled  data  without  difficulties. 

The  power  spectral  density  of  the  sole  reference  clock 
was  modelled  by 


Sn(f)  = 


1(T30  Hz3  10-22  Hz 

/4  +  p 


(18) 


true,  close  to  one.  Hence,a  computational  feasible  h(r) 
should  be  chosen,  whose  power  transfer  function  H(fy 
changes  rapidly  from  one  to  zero  at  a  certain  comer 
frequency*  We  decided  to  use  a  two-sided  exponential 
function 


1  -I  t\/T 


H(f)  - 


1  +  (2tt/T)2  ’ 


(20) 


for  this  purpose.  Figure  4  shows  the  power  transfer 
function  H(f)2  for  this  weighting  function,  which  de¬ 
cays  as  /“4  for  f  large  enough. 

The  only  remaining  problem  was  to  fix  the  parame¬ 
ter  T,  which  was  done  by  computing  5C(/)  for  various 
values  of  T  and  choosing  the  one  with  the  lowest  roofc- 
mean^square  value  of  f(t)  (which  can  be  calculated  sim¬ 
ply  by  integrating  the  spectrum).  The  eventually  chosen 
value  was 


where  the  first  term  reflects  the  — deliberately  overes¬ 
timated  (at  minimum  6  dB  higher) —  random  walk  of 
our  rubidium  clock,  cf,  the  lowest  frequencies  in  Figure  2. 
The  second  term  accounts  for  the  rubidium  dock’s  white 
frequency  noise,  which  was  found  in  our  measurements 
against  the  cesium  normal  at  frequencies  higher  than 
1CT4  Hz. 

To  characterize  the  noise  properties  of  the  sole  1  pps 
pulses  of  the  Stellar,  we  simply  assume  that  the  white 
phase  noise  apparent  in  Figure  2  extends  to  frequencies 
lower  than  /  =  10 “5  Hz  as  well.  Hence,  we  simply  cut 
off  the  random  walk  part  to  arrive  at  Ss{f)  depicted  in 
Figure  3  below.  After  all,  the  reference  clock’s  random 
walk  noise  dominates  at  the  lowest  frequencies,  so  that 
we  cannot  extract  further  information  out  of  Sx(f).  Any 
overlooked  noise  remains  in  the  term  z%(t ),  cf.  (5).  Note 
that  this  is  also  true  for  the  two  peaks  in  Figure  2,  which 
fully  survive  the  averaging  process. 

With  those  preparations,  we  can  eventually  attack 
the  problem  of  choosing  h(r)\  Since  all  contributions  to 
C(t)  are  reasonably  assumed  to  be  zero-mean,  stationary 
power  signals  and  (s(t)  and  £r(£)  are  obviously  statisti¬ 
cally  independent,  the  usual  superposition  and  filtering 
properties  [Car86,  p.  166ff]  for  power  spectral  densities 
apply.  The  filter  function  involved  in  fs(£)  is  just  h(r), 
the  one  in  0*(t)  —  C<r(*0  reads  <5(r)  —  h(r)  with  £(r) 
denoting  Dirac’s  delta- function,  so  that  immediately 

5<(/)  =  Ss(f)H(ff  +  SR(f)  (1  -  H(f))2 , 

where  H(f)  is  the  Fourier  transform  of  h(r);  note  that, 
because  of  the  requested  even  symmetry  of  h(r),  we 
have  H(f)  =  //*(/),  i.e.,  a  real- valued  function. 

Differentiating  equation  (19)  and  equating  it  to  zero, 
we  obtain  the  optimal  (minimizing)  choice  of  H(f)  as 

HW=s^kfy  <“> 

Essentially,  it  says  — what  intuitively  seems  clear —  that 
whenever  Ss(f)  dominates  over  Sr(/),  the  function 
H(f)  should  be  close  to  zero,  and  when  the  opposite  is 


T  =  3450  s  resulting  in  ^  =  6.5  ns.  (21) 

Table  3  finally  provides  the  results  of  applying  this 
averaging  function  to  the  sampled  data  according  to 
(10).  For  comparison,  we  provide  the  findings  for  the 
non-averaged  case  (11)  as  well. 

In  both  cases,  we  are  confronted  with  a  term  of  un¬ 
known  value  s!(t)  resp.  z|(t),  which  barely  differ  for  the 
chosen  value  of  T.  As  mentioned  earlier,  it  covers  both 
unknown  systematic  errors  like  imperferctly  known  an¬ 
tenna  position  and  deterministic  delays  in  the  receiver, 
as  well  as  slowly  varying  stochastic  errors  originating  in 
SA  and  variations  of  the  tropospherical/ionospherical 
delays.  Unfortunately,  there  is  no  other  way  of  resolv¬ 
ing  this  uncertainity  but  to  establish  a  more  accurate 
access  to  GPST,  e.g.,  by  means  of  common-view  tech¬ 
niques, 

5  Results 

In  this  section,  we  survey  the  results  of  the  analysis  of 
the  778  MB  of  sampled  data  in  order  to  answer  the  ques¬ 
tions  of  Section  3.  Additional  information  and  further 
details  may  be  found  in  [Hoe96], 

5.1  Accuracy-related  Quantities 

According  to  item  (1)  of  the  list  of  questions  in  Sec¬ 
tion  3,  we  have  to  consider  the  difference  r(t)  of  a  re¬ 
ceiver’s  view  of  GPS  time  and  our4  reference  time  ob¬ 
served  at  the  occurrence  of  the  1  pps  pulse.  The  sought 
distribution  of  x(t)  is  in  fact  the  quantity  of  primary  in¬ 
terest  in  most  evaluation  reports  on  GPS  receivers,  cf. 
[KMB94],  In  our  clock  validation  framework,  it  is  pri¬ 
marily  required  for  deciding  what  maximum  time  un¬ 
certainity  must  be  granted  for  a  correct  GPS  receiver. 

4  Refer  to  Section  4  for  the  expected  accuracy  of  our  refer¬ 
ence  time,  that  is,  its  deviation  from  real-time  t.  Note  that  the 
appropriateness  of  our  method  of  computing  the  reference  time 
is  also  confirmed  by  the  fact  that  the  distribution  of  #(t)  for 
the  Motorola  GPS  receiver  in  Figure  7  is  in  accordance  with  the 
results  obtained  in  [KMB94]. 
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Figure  7  in  the  appendix  shows  the  distribution  of 
x(t)  for  all  of  our  GPS  receivers.  Only  correct  1  pps 
pulses  were  considered  here,  and  any  known  systematic 
bias  (e.g.  resulting  from  the  antenna  cable  delay)  was 
removed  beforehand.  Moreover,  the  respective  mean 
value  x  was  subtracted  in  the  plots  to  make  direct  com¬ 
parison  easier.  Table  2  summarizes  the  characteristic 
values  of  those  distributions,  namely,  mean  T,  standard 
deviation  (root  mean  square)  ax,  and  minimum  and 
maximum  offset  e_  and  taken  relatively  to 

Next,  we  turn  our  attention  to  questions  (2)  and  (3) 
in  the  list  of  Section  3,  which  are  devoted  to  the  fre¬ 
quency  stability  of  a  GPS  receiver  for  short  averaging 
times  r  6  [10  s . .  *  100  s].  The  sought  distribution  of 
the  differences  A:r(r)  =  x(t  4-  r)  —  x(t)  between  the 
time  deviation  of  a  GPS  receiver’s  1  pps  pulses  lying 
(integer)  r  seconds  apart  is  particularily  important  for 
rate  synchronization  purposes:  Our  clock  validation  ap¬ 
proach  targets  1  /js  synchronization  tightness  [HSS97], 
which  makes  it  inevitable  to  synchronize  not  only  clock 
states  but  also  clock  rates.  In  [Scho97],  a  suitable  rate 
synchronization  algorithm  was  introduced  that  requires 
periodic  initiation  with  period  Pr  £  [10  s  , . .  100  s].  For 
good  performance,  however,  the  intervals  between  any 
two  initiation  events  should  be  as  regular  as  possible. 

Figure  8  and  9  in  the  appendix  show5  the  distribu¬ 
tions  of  A^(r),  r  E  {30  s,  100  s},  for  all  the  1  pps  and 
10  MHz-derived  outputs  of  our  GPS  receivers.  Similar- 
ily  as  before,  only  correct  pulses  were  considered  here. 
Table  4  summarizes  the  characteristic  values  of  those 
(zero-mean)  distributions,  namely,  standard  deviation 
<rx,  maximum  value  e(r)  =  max  | Atf(r)|,  and  corre¬ 
sponding  maximum  mean  frequency  deviation  (stabil¬ 
ity)  v(t)  =  e(r)/r. 

Relating  the  results  for  the  1  pps  outputs  vs.  the 
“artificial”  1  pps  pulses  derived  from  10  MHz  frequency 
outputs  answers  the  question  whether  rate  synchroniza¬ 
tion  could  benefit  from  GPS  receivers  with  frequency 
output.  However,  it  turns  out  that  the  additional  ef¬ 
fort  is  not  worthwhile,  at  least  for  GPS  receivers  like 
the  Stellar  or  the  NavSymm:  The  ordinary  1  pps  signal 
does  not  provide  a  significantly  worse  behavior, 

5.2  Faulty  Behavior 

The  issues  of  primary  interest  for  fault  tolerance  are  of 
course  items  (4)  and  (5)  in  the  list  of  questions  in  Sec¬ 
tion  3,  Owing  to  the  fact  that  the  receivers  of  Table  1 
performed  quite  differently  in  this  respect,  we  briefly  re¬ 
port  on  the  observed  failures  of  each  receiver  separately. 

Stellar  GPS  100A 

This  GPS  receiver  produced  no  failures  except  12  “spu¬ 
rious”  1  pps  pulses,  which  appeared  — partly  in  bursts — 

5 Note  that  the  results  in  Figure  8  resp.  9  and  Table  4  are 
considerably  spoiled  by  the  quantization  noise  caused  by  the  rel¬ 
atively  coarse  granularity  (8  ns)  of  our  measurement  setup.  The 
vertical  “stripes”  appearing  in  the  distributions  are  a  visible  sign 
of  this  problem,  which  obviously  becomes  less  serious  when  r  is 
increased. 


arbitrarily  in  between  regular  ones.  We  suppose  that 
interfacing  problems  (possibly  caused  by  ground  loops) 
are  responsible  for  this  problem. 

NavSymm  NTFR-S 

The  1  pps  pulses  of  the  originally  shipped  NavSymm 
receiver  exhibited  a  constant  bias  of  250  /is  ahead  of 
UTC,  which  went  completely  unnoticed  up  to  our  first 
measurement  epoch.  It  turned  out  that  this  problem 
was  the  result  of  a  known(!)  firmware  bug,  which  was 
fixed  in  a  replacement  unit  eventually  used  for  actual 
evaluation. 

The  collected  1  pps  data  from  the  NavSymm  re¬ 
ceiver  revealed  8  pulse  jumps  similar  to  the  one  shown 
in  Figure  5;  Initially,  the  so-called  ACC-TIME  value  in 
the  SFM-Message  (indicating  the  2 <r- accuracy)  jumped 
to  zero,  which  means  inacceptable  accuracy.  A  few  sec¬ 
onds  later,  the  time  offset  x(t)  increased  to  several  mil¬ 
liseconds  and  persisted  in  that  gross  error  for  about 
1  minute.  In  addition,  a  few  1  pps  pulses  were  occa¬ 
sionally  lost  during  that  period  as  well.  Even  worse, 
ACC- TIME  returned  to  normal  values  of  about  200- 
300  ns  shortly  after  the  pulse  jump,  although  the  1  pps 
pulses  were  still  extremelyoffset  from  UTC.  Eventually, 
x(t)  instantaneously  decreased  to  about  30  ps,  from 
where  it  slowly  approached  normal  values  (within  an¬ 
other  minute). 

Moreover,  the  NavSymm  receiver  also  produced  6 
pulse  ramps  like  the  one  shown  in  Figure  6:  The  whole 
phenomenon  lasted  more  than  1  minute  and  started 
with  a  change  of  ACC-TIME  to  zero,  after  which  the 
offset  z(t)  gradually  grew  to  magnitudes  around  1  vs. 
While  the  pulse  was  still  offlying,  ACC-TIME  resumed 
displaying  normal  values,  which  were  eventually  also 
reached  by  :r(fc). 

Note  that  both  kinds  of  failure  forced  us  to  exclude 
certain  1  pps  pulses  when  computing  the  statistics  of 
the  NavSymm  receiver  in  Section  5.1.  More  specifically, 
we  discarded  all  pulses  that  occurred  within  150  s  after 
ACC-TIME  became  zero. 

There  was  another,  unexpected  failure  in  the  RS232- 
supplied  time  tag  accompanying  2-3  consecutive  1  pps 
pulses  at  the  beginning  of  certain  days:  The  indi¬ 
cated  day  was  too  small.  For  example,  the  receiver 
said  1995  Dec  14  00:00:00,  while  it  should  have  said 
1995  Dec  15  00:00:00. 

Motorola  VP-Oncore 

There  were  no  failures  except  of  ten  omitted  1  pps 
pulses,  which  were  lost  along  with  their  time  tags. 

Trimble  SVeeSix-CM2 

There  were  no  failures  in  the  1  pps  pulses,  but  several 
incorrect  time  tags  during  leap  second  insertion:  The 
Trimble  receiver  outputs  the  time  tag  via  its  RS232  in¬ 
terface  both  in  UTC  and  GPST.  It  happened  that  a 
leap  second  insertion  was  announced  for  the  end  of  1995, 
which  changed  the  difference  GPST-UTC  from  10  s  to 
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11  s*  The  Trimble  receiver  inserted  the  leap  second  in¬ 
correctly  on  1996  Jan  01  00:00:00  GPST  (=*1995  Dec  31 
23:59:50  UTC)  instead  of  1996  Jan  01  00:00:00  UTC, 
Therefore,  the  UTC  second  information  was  incorrect 
for  ten  seconds. 

Magellan  Brain 

During  0.3  %  of  our  evaluation  period,  the  Magellan  re¬ 
ceiver  was  in  the  so-called  coasti up-mode,  where  too  few 
satellites  are  tracked  to  obtain  correct  measurements. 
The  linearly  growing  offset  r(t)  indicates  that  the  re¬ 
ceiver  derives  its  1  pps  pulse  directly  from  its  local  clock 
in  this  case.  Due  to  its  low  quality,  this  implies  large 
time  deviations  at  the  end  of  long  coasting  periods  (the 
longest  one  lasted  994  seconds!),  which  are  instanta¬ 
neously  corrected  upon  the  transition  to  normal  opera¬ 
tion. 

Apart  from  coasting,  the  receiver  also  showed  very 
irregular  behavior  during  times  of  bad  accuracy,  which 
are  indicated  by  the  supplied  TFOM  value  (time  figure 
of  merit,  giving  the  expected  time  error  of  the  1  pps 
pulse).  For  about  10  %  of  the  measurement  period,  this 
value  indicated  time  errors  greater  than  1  ps.  The  ac¬ 
tual  behavior  of  x(t),  however,  was  much  worse:  Apart 
from  ramp  errors,  sudden  jumps  of  10  and  1  ms  oc¬ 
curred  quite  frequently.  Note  that  such  jumps  were  also 
observed  for  TFOM  values  less  than  1  ^s.  As  in  case  of 
the  NavSymm  receiver,  those  frequent  failures  forced  us 
to  discard  erroneous  pulses  from  the  statistical  analysis 
in  Section  5.1,  More  specially,  we  discarded  all  pulses 
with  TFOM  >  1  ps,  as  well  as  all  remaining  ones  with 
offset  £(t)  >  1  £ts. 

In  addition,  one  out  of  thousand  of  the  time  tags 
transmitted  via  RS232  were  found  to  be  incorrect  (usu¬ 
ally  off  by  one  second).  This  usually  appears  for  whole 
“blocks”  of  consecutive  seconds,  primarily  in  conjunc¬ 
tion  with  erroneous  1  pps  pulses.  The  maximum  ob¬ 
served  block  length  was  993  s. 

Rockwell  Microtracker 

The  1  pps  pulse  data  of  this  receiver  revealed  a  bad  accu¬ 
racy  (a;(t)  in  the  10  grange,  cf.  Figure  7),  which  made 
it  impossible  to  separate  normal  behavior  and  failures, 

6  Conclusions  and  Future  Work 

Our  results,  as  limited  as  they  are  due  to  their  snapshot¬ 
like  nature,  reveal  a  number  of  interesting  facts  about 
the  issues  touched  in  Section  2.  First  of  all,  our  find¬ 
ings  confirm  that  trusting  blindly  in  all  timing  data 
provided  by  a  GPS  receiver  is  definitely  inappropriate 
for  fault-tolerant  applications.  Moreover,  since  failures 
like  systematic  bias  cannot  be  locally  detected,  redun¬ 
dant  verification  information  is  mandatory  —  and  this 
is  exactly  the  basic  assumption  underlying  our  interval- 
based  clock  validation  scheme. 

In  addition,  the  following  facts  deserve  attention: 


•  Transient  omissions  of  1  pps  pulses  are  relatively 
frequent. 

•  One  cannot  always  rely  upon  the  health  status  pro¬ 
vided  by  a  GPS  receiver,  in  particular  after  a  non¬ 
health  situation. 

•  The  time  tag  can  be  wrong,  making  some  kind  of 
agreement  mandatory. 

On  the  other  hand,  we  do  not  have  enough  infor¬ 
mation  on  erroneous  1  pps  pulses  for  quantitative  mod¬ 
elling,  in  the  sense  that  we  are  unable  to  give  meaningful 
failure  probabilities.  We  can  only  infer  that  the  prob¬ 
ability  of  any  transient  failure  is  about  10’6,  without 
significant  correlations  between  different  receivers.  Our 
data  reveal  actually  three  different  classes  of  transient 
failures,  namely 

•  “obviously”  erroneous  (spurious)  pulses, 

•  “step”  pulses,  characterized  by  a  sudden  deviation 
from  the  correct  time, 

•  ‘Vamp”  pulses,  which  drift  away  from  correct  time 
gradually  (and  usually  slowly). 

Clock  validation  can  eliminate  the  former  two  but  not 
the  latter  one,  which  are  hence  those  failures  where  we 
actually  need  more  information.  Note  that  our  observa¬ 
tions  correspond  nicely  to  findings  in  integrity  research; 
recall  Section  1,  where  one  distinguishes  step  and  ramp 
errors:  It  is  well-known  that  the  latter  failures  are  more 
difficult  to  iron  out  by  RAIM/FDI  than  the  former  ones; 
$eeke.g.,[Mic95],  [GKKT95],  [BSK89]. 

In  order  to  get  meaningful  information  on  failure 
probabilities,  it  is  inevitable  to  extend  the  2- month  pe¬ 
riod  of  experimental  evaluation  considerably.  Rerun¬ 
ning  our  evaluation  is  also  required  for  keeping  track 
with  the  rapidly  maturing  GPS  receiver  technology, 
which  renders  our  1993“ 1995  receivers  partly  as  out-of- 
date  models.  The  improved  reliability  of  state-of-the-art 
brands/models  of  GPS  receivers,  however,  calls  for  an 
even  much  longer  period  of  data  acquisition  in  order  to 
get  hold  of  failures. 

To  support  longer  evaluation  periods,  several  defi¬ 
ciencies  and  limitations  of  our  experimental  setup  must 
be  removed: 

•  The  reliability  of  the  measuring  equipment  — 
involving  numerous  components —  needs  improve¬ 
ment,  since  42  of  the  more  than  10e  readouts  of  LA 
memory  failed.  Although  this  does  of  course  not 
invalidate  our  results  (the  resulting  probability  of 
overlooking  an  erroneous  behavior  is  only  about 
10-10),  something  should  be  done  about  it. 

•  Noise  induced  by  ground  loops  seems  to  be  a  major 
source  of  problems,  which  might  even  affect  the 
interfaces  to  the  GPS  receivers, 

•  Size  and  .  lacking  robustness  of  the  experimented 
setup  prohibit  an  easy  change  of  location,  which 
is  desirable  both  for  varying  reception  conditions 
and  “calibration”  purposes  (see  next  item). 

•  It  turned  out  that  the  stability  of  our  (relatively 
low  cost)  rubidium  atomic  clock  is  not  exciting 
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and  should  be  somewhat  improved.  Incorporat¬ 
ing  common-view  techniques  or  moving  the  whole 
experimental  setup  to  an  institution  with  a  cesium 
atomic  clock,  preferably  one  that  contributes  to 
UTC,  would  of  course  be  a  more  appealing  alter¬ 
native, 

•  Some  countermeasures  against  long-lasting  disrup¬ 
tions  due  to  unnoticed  power  failures  should  also 
be  considered. 

An  appropriately  improved  and  extended  experi¬ 
mental  evaluation  will  be  incorporated  in  the  compre¬ 
hensive  evaluation  of  our  interval-based  clock  valida¬ 
tion  architecture  [HSS97],  It  will  utilize  a  completely 
different  data  acquisition  system  based  on  a  custom 
timestamping  unit  in  conjunction  with  robust  industrial 
VME-bus  components,  which  is  currently  under  devel¬ 
opment. 
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Model 

#Chn, 

Year/ Vers. 

us  $ 

Stellar  100  GPS  Clock 

5  1 

1995 

4,500,- 

NavSymm  NTFR-S 

6 

1995/2.9 

3,500,- 

Motorola  VP  Oncore 

6 

Trimble  SVeeSix-CM2 

6 

1994 

750,“- 

Magellan  Brain 

5 

1993 

600,- 

Rockwell  Microtracker 

5 

1993 

Table  1:  GPS  receivers  used  for  evaluation 


Signal 

IHBiEI 1 

0 

37 

-188 

191 

244 

46 

-263 

361 

Motorola  1  pps 

108 

253 

Trimble  1  pps 

310 

309 

-1308 

1346 

60 

155 

-1602 

1677 

7.933 

2.380 

-5434 

4518 

Table  2:  Characteristic  values  for  the  1  pps  pulses  vs .  refer¬ 
ence  time 


“Note  that  those  characteristic  values  ^in  particular,  the  mean 
x —  are  not  fully  compatible  with  the  corresponding  ones  of  the 
other  receivers  due  to  the  fact  that  the  NavSymm  cannot  output 
GPST  on  its  1  pps  signal,  but  only  UTC. 

*The  1  pps  pulse  provided  by  the  Rockwell  receiver  is  not  phase- 
locked  to  GPST  but  rather  free-running.  An  offset  value  supplied 
via  RS323  must  be  used  to  compute  a  “software  1  pps  pulse” . 


KtTEiTOlSITTSfETM 

Amount 

without 

KHQBBH 

unknown 

Systematic  and  slowly  varying  1  pps  noise  | 

KQHH 

msmmm 

^■1 

Averaged  ^(t) 

with 

C  s(t) _ 

a  =  5.7  ns 

Averaged  (s(t) 

No  significant  drift  in  data 

msBmm 

ima 

Introduced  noise  of  rubidium  clock 

Table  3:  Error  contrifcuttons  for  non-averaged  and  averaged  I  pps  pulses  of  Stellar  receiver 


Receiver 

■■■ 

e(r)/ns 

y(r) 

Stellar 

30 

s 

10.9 

80 

m 

EEBI 

Stellar 

100 

s 

27.2 

196 

EB 

EEBfl 

Stellar  10  MHz 

30 

s 

84 

m 

on 

Stellar  10  MHz 

100 

s 

27.0 

200 

HSI 

mm 

NavSymm 

3CT 

s 

27,1 

201 

EEBfl 

NavSymm 

100 

s 

47.5 

399 

ebh 

NavSymm  10  MHz 

30 

s 

29.7 

224 

[22 

EEBfl 

NavSymm  10  MHz 

100 

s 

49.2 

394 

K1B1 

ESH 

Motorola 

”30 

s 

44,8 

252 

n 

Qg| 

Motorola 

100 

s 

51.7 

290 

WEI 

EEBfl 

Trimble 

”30 

s 

383.5 

1688 

E3 

mm 

Trimble 

100 

s 

413.6 

1715 

KS2 

fEBfl 

Magellan 

”30 

s 

70.6 

1896 

13E1 

mm 

Magellan 

100 

s 

1865 

WEI 

mm 

Rockwell 

30 

s 

210.4 

6685 

2.2 

10-'! 

Rockwell 

100 

s 

251.6 

6997 

KTil 

IBH 

Table  4:  Characteristical  values  for  pulses  lying  r  secon  ds  apart 
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Figure  3:  Power  spectral  density  for  1  pps  pulse  cleaned 
from  rb  clock  random  walk  noise 
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Figure  4;  Power  transfer  function  for  a  weighting  function 
h(r)  =  1/2 Te-W/r  T  =  3450  s 
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Figure  5:  Pulse  jumps  of  the  NavSym  receiver 


Figure  6:  Pulse  ramps  of  the  NavSym  receiver 


